Issue #3189: CA not approving CSR forwarded by ACME Responder - dogtagpki

dogtagpki

#3189 CA not approving CSR forwarded by ACME Responder

Closed: fixed 3 years ago by edewata. Opened 3 years ago by olelar.

Hello,

Description of problem

When attempting to use certbot to get a certificate through the ACME responder it ends up timing out. I get the following error:

sudo certbot certonly --standalone -d example.com --server 
http://example.com:8080/acme/directory --agree-tos --register-unsafely-without-email

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Registering without email!
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.com
Waiting for verification...
Cleaning up challenges
An unexpected error occurred:

requests.exceptions.ReadTimeout: HTTPConnectionPool(host='example.com', port=8080): Read timed out. (read timeout=45)

Please see the logfiles in /var/log/letsencrypt for more details.

certbot log

2020-07-01 11:05:24,091:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File "/usr/lib/python3.8/site-packages/urllib3/connectionpool.py", line 421, in _make_request
six.raise_from(e, None)
File "<string>", line 3, in raise_from
File "/usr/lib/python3.8/site-packages/urllib3/connectionpool.py", line 416, in _make_request
httplib_response = conn.getresponse()
File "/usr/lib64/python3.8/http/client.py", line 1332, in getresponse
response.begin()
File "/usr/lib64/python3.8/http/client.py", line 303, in begin
version, status, reason = self._read_status()
File "/usr/lib64/python3.8/http/client.py", line 264, in _read_status
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/usr/lib64/python3.8/socket.py", line 669, in readinto
return self._sock.recv_into(b)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
  File "/usr/lib/python3.8/site-packages/urllib3/connectionpool.py", line 719, in urlopen
retries = retries.increment(
 File "/usr/lib/python3.8/site-packages/urllib3/util/retry.py", line 400, in increment
raise six.reraise(type(error), error, _stacktrace)
 File "/usr/lib/python3.8/site-packages/urllib3/packages/six.py", line 703, in reraise
raise value
 File "/usr/lib/python3.8/site-packages/urllib3/connectionpool.py", line 665, in urlopen
httplib_response = self._make_request(
 File "/usr/lib/python3.8/site-packages/urllib3/connectionpool.py", line 423, in _make_request
self._raise_timeout(err=e, url=url, timeout_value=read_timeout)
 File "/usr/lib/python3.8/site-packages/urllib3/connectionpool.py", line 330, in _raise_timeout
raise ReadTimeoutError(
urllib3.exceptions.ReadTimeoutError: HTTPConnectionPool(host='example.com', port=8080): 
Read timed out. (read timeout=45)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in <module>
load_entry_point('certbot==1.5.0', 'console_scripts', 'certbot')()
File "/usr/lib/python3.8/site-packages/certbot/main.py", line 15, in main
return internal_main.main(cli_args)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1347, in main
return config.func(config, plugins)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1233, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 121, in _get_and_save_cert
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 409, in obtain_and_enroll_certificate
cert, chain, key, _ = self.obtain_certificate(domains)
File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 359, in obtain_certificate
cert, chain = self.obtain_certificate_from_csr(csr, orderr)
File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 291, in obtain_certificate_from_csr
orderr = self.acme.finalize_order(orderr, deadline)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 901, in finalize_order
return self.client.finalize_order(orderr, deadline)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 749, in finalize_order
self._post(orderr.body.finalize, wrapped_csr)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 96, in _post
return self.net.post(*args, **kwargs)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 1177, in post
return self._post_once(*args, **kwargs)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 1189, in _post_once
response = self._send_request('POST', url, data=data, **kwargs)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 1094, in _send_request
response = self.session.request(method, url, *args, **kwargs)
File "/usr/lib/python3.8/site-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3.8/site-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3.8/site-packages/requests/adapters.py", line 529, in send
raise ReadTimeout(e, request=request)
requests.exceptions.ReadTimeout: HTTPConnectionPool(host='example.com', port=8080): Read 
timed out. (read timeout=45)
2020-07-01 11:05:24,106:ERROR:certbot._internal.log:An unexpected error occurred:
2020-07-01 11:05:24,107:ERROR:certbot._internal.log:requests.exceptions.ReadTimeout: 
HTTPConnectionPool(host='example.com', port=8080): Read timed out. (read timeout=45)

ACME log

It is very long so I am only including the last lines. Right before this it printed request to the log.

2020-07-01 11:04:40 [http-nio-8080-exec-10] INFO: HTTP request: POST /ca/rest/certrequests HTTP/1.1
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Accept: application/xml
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Type: application/xml
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Length: 2049
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Host: example.com:8443
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Connection: Keep-Alive
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   User-Agent: Apache-HttpClient/4.5.10 (Java/1.8.0_252)
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO: HTTP response: HTTP/1.1 200 
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Type: application/xml;charset=UTF-8
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Length: 745
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Date: Wed, 01 Jul 2020 18:04:41 GMT
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Keep-Alive: timeout=300
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Connection: keep-alive
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO: Responses:
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:  - Request ID: 10
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:    Type: enrollment
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:    Request Status: pending
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:    Operation Result: success
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO: HTTP request: GET /ca/rest/agent/certrequests/10 HTTP/1.1
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Accept: application/xml
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Host: example.com:8443
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Connection: Keep-Alive
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   User-Agent: Apache-HttpClient/4.5.10 (Java/1.8.0_252)
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO: HTTP response: HTTP/1.1 401 
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Cache-Control: private
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Expires: Thu, 01 Jan 1970 00:00:00 GMT
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   WWW-Authenticate: Basic realm="Certificate Authority"
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Type: text/html;charset=utf-8
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Language: en
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Content-Length: 669
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Date: Wed, 01 Jul 2020 18:04:41 GMT
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Keep-Alive: timeout=300
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Connection: keep-alive
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO: HTTP request: GET /ca/rest/agent/certrequests/10 HTTP/1.1
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Accept: application/xml
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Host: example.com:8443
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Connection: Keep-Alive
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   User-Agent: Apache-HttpClient/4.5.10 (Java/1.8.0_252)
2020-07-01 11:04:41 [http-nio-8080-exec-10] INFO:   Authorization: ********
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO: HTTP response: HTTP/1.1 200 
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Cache-Control: private
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Expires: Thu, 01 Jan 1970 00:00:00 GMT
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Set-Cookie:                 JSESSIONID=652F6A5341436BCCB9D6F46D06BE9260; Path=/ca; Secure; HttpOnly
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Content-Type: application/xml;charset=UTF-8
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Transfer-Encoding: chunked
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Date: Wed, 01 Jul 2020 18:04:41 GMT
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Keep-Alive: timeout=300
2020-07-01 11:04:42 [http-nio-8080-exec-10] INFO:   Connection: keep-alive
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO: HTTP request: POST         /ca/rest/agent/certrequests/10/approve HTTP/1.1
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   Accept: application/xml
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   Content-Type: application/xml
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   Content-Length: 21380
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   Host: example.com:8443
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   Connection: Keep-Alive
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   User-Agent: Apache-HttpClient/4.5.10 
(Java/1.8.0_252)
2020-07-01 11:04:43 [http-nio-8080-exec-10] INFO:   Cookie: 
JSESSIONID=652F6A5341436BCCB9D6F46D06BE9260

CA Log

Just including the last few lines. Just before this there is a warning that the certificate request was deferred

2020-07-01 11:04:41 [https-jsse-nio-8443-exec-25] INFO: Updating certificate request
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: Authenticating user caadmin with password.
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: PasswdUserDBAuthentication: authenticating UID: caadmin
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: UGSubsystem: retrieving user uid=caadmin,ou=People,dc=ca,dc=pki,dc=example,dc=com
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: PasswdUserDBAuthentication: DN: uid=caadmin,ou=people,dc=ca,dc=pki,dc=example,dc=com
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: UID caadmin authenticated.
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: UGSubsystem: retrieving user uid=caadmin,ou=People,dc=ca,dc=pki,dc=example,dc=com
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: User DN: uid=caadmin,ou=people,dc=ca,dc=pki,dc=example,dc=com
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: Roles:
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Certificate Manager Agents
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Security Domain Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Enterprise CA Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Enterprise KRA Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Enterprise OCSP Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Enterprise TKS Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Enterprise RA Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: - Enterprise TPS Administrators
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: UGSubsystem: retrieving user uid=caadmin,ou=People,dc=ca,dc=pki,dc=example,dc=com
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: AAclAuthz: Granting execute permission for certServer.ca.certrequests
2020-07-01 11:04:41 [https-jsse-nio-8443-exec-2] INFO: Reviewing certificate request 10
2020-07-01 11:04:42 [https-jsse-nio-8443-exec-2] INFO: CertRequestDAO: Nonce: 
3027137019525098048
2020-07-01 11:04:43 [https-jsse-nio-8443-exec-3] INFO: UGSubsystem: retrieving user uid=caadmin,ou=People,dc=ca,dc=pki,dc=example,dc=com
 2020-07-01 11:04:43 [https-jsse-nio-8443-exec-3] INFO: AAclAuthz: Granting execute permission for certServer.ca.certrequests
 2020-07-01 11:06:34 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: updating serial numbers
 2020-07-01 11:06:35 [Timer-0] INFO: SessionTimer: checking security domain sessions
 2020-07-01 11:11:35 [Timer-0] INFO: SessionTimer: checking security domain sessions
 2020-07-01 11:16:34 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: updating serial numbers
2020-07-01 11:16:35 [Timer-0] INFO: SessionTimer: checking security domain sessions
2020-07-01 11:21:35 [Timer-0] INFO: SessionTimer: checking security domain sessions

How reproducible

Always

How to reproduce

1) Either install the packages using yum or build from source as described in the dev guide here: https://github.com/dogtagpki/pki/blob/master/docs/development/Building_PKI.md

2) Install DS as described here: https://www.dogtagpki.org/wiki/Installing_DS

3) Install the CA either using the interactive pkispawn or using the guide here: https://github.com/dogtagpki/pki/blob/master/docs/installation/Installing_CA.md

4) Install and configure ACME responder as described here: https://github.com/dogtagpki/pki/blob/v10.8/docs/installation/Installing_ACME_Responder.md

Versions

OS: Fedora 32
Certbot: 1.5.0

dogtag-pki-10.8.3-1.fc32.x86_64.rpm
dogtag-pki-console-theme-10.8.3-1.fc32.noarch.rpm
dogtag-pki-server-theme-10.8.3-1.fc32.noarch.rpm
pki-base-10.8.3-1.fc32.noarch.rpm
pki-base-java-10.8.3-1.fc32.noarch.rpm
pki-ca-10.8.3-1.fc32.noarch.rpm
pki-console-10.8.3-1.fc32.noarch.rpm
pki-debuginfo-10.8.3-1.fc32.x86_64.rpm
pki-debugsource-10.8.3-1.fc32.x86_64.rpm
pki-javadoc-10.8.3-1.fc32.noarch.rpm
pki-kra-10.8.3-1.fc32.noarch.rpm
pki-ocsp-10.8.3-1.fc32.noarch.rpm
pki-server-10.8.3-1.fc32.noarch.rpm
pki-symkey-10.8.3-1.fc32.x86_64.rpm
pki-symkey-debuginfo-10.8.3-1.fc32.x86_64.rpm
pki-tks-10.8.3-1.fc32.noarch.rpm
pki-tools-10.8.3-1.fc32.x86_64.rpm
pki-tools-debuginfo-10.8.3-1.fc32.x86_64.rpm
pki-tps-10.8.3-1.fc32.x86_64.rpm
pki-tps-debuginfo-10.8.3-1.fc32.x86_64.rpm
python3-pki-10.8.3-1.fc32.noarch.rpm

Expected result

I am expecting that the certificate will be approved and made available for download by Certbot. I can see the requests in the CA if I log in with the admin cert, but they are "pending" and not approved.

cipherboy commented 3 years ago

@olelar -- can you check which version of JSS you have installed too?

Metadata Update from @cipherboy:
- Custom field component adjusted to None
- Custom field feature adjusted to None
- Custom field origin adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field type adjusted to None
- Custom field version adjusted to None

3 years ago

olelar commented 3 years ago

@olelar -- can you check which version of JSS you have installed too?

It looks like jss-4.7.0-0.2.

This is what I got from running "dnf builddepp -y --spec pki.spec" again.

Package apache-commons-cli-1.4-8.fc32.noarch is already installed.
Package apache-commons-codec-1.13-2.fc32.noarch is already installed.
Package apache-commons-io-1:2.6-8.fc32.noarch is already installed.
Package apache-commons-lang-2.6-27.fc32.noarch is already installed.
Package apr-devel-1.7.0-3.fc32.x86_64 is already installed.
Package apr-util-devel-1.6.1-12.fc32.x86_64 is already installed.
Package cmake-3.17.3-1.fc32.x86_64 is already installed.
Package cyrus-sasl-devel-2.1.27-4.fc32.x86_64 is already installed.
Package freeipa-healthcheck-core-0.5-3.fc32.noarch is already installed.
Package gcc-c++-10.1.1-1.fc32.x86_64 is already installed.
Package git-2.26.2-1.fc32.x86_64 is already installed.
Package glassfish-jaxb-api-2.2.12-14.fc32.noarch is already installed.
Package golang-github-cpuguy83-md2man-2.0.0-0.5.20190624gitf79a8a8.fc32.x86_64 is already installed.
Package httpd-devel-2.4.43-1.fc32.x86_64 is already installed.
Package idm-console-framework-1.2.0-4.fc32.noarch is already installed.
Package jakarta-commons-httpclient-1:3.1-33.fc32.noarch is already installed.
Package java-1.8.0-openjdk-devel-1:1.8.0.252.b09-1.fc32.x86_64 is already installed.
Package jboss-annotations-1.2-api-1.0.2-2.fc32.noarch is already installed.
Package jboss-jaxrs-2.0-api-1.0.0-10.fc32.noarch is already installed.
Package jboss-logging-3.4.1-2.fc32.noarch is already installed.
Package javapackages-tools-5.3.0-9.fc32.noarch is already installed.
Package jss-4.7.0-0.2.fc32.x86_64 is already installed.
Package junit-1:4.12-13.fc32.noarch is already installed.
Package ldapjdk-4.22.0-1.fc32.noarch is already installed.
Package make-1:4.2.1-16.fc32.x86_64 is already installed.
Package nspr-devel-4.25.0-1.fc32.x86_64 is already installed.
Package nss-devel-3.53.0-2.fc32.x86_64 is already installed.
Package nss-tools-3.53.0-2.fc32.x86_64 is already installed.
Package openldap-devel-2.4.47-4.fc32.x86_64 is already installed.
Package openssl-1:1.1.1g-1.fc32.x86_64 is already installed.
Package pcre-devel-8.44-1.fc32.x86_64 is already installed.
Package pkgconf-pkg-config-1.6.3-3.fc32.x86_64 is already installed.
Package policycoreutils-3.0-2.fc32.x86_64 is already installed.
Package python3-3.8.3-1.fc32.x86_64 is already installed.
Package python3-cryptography-2.8-3.fc32.x86_64 is already installed.
Package python3-devel-3.8.3-1.fc32.x86_64 is already installed.
Package python3-flake8-3.7.7-7.fc32.noarch is already installed.
Package python3-ldap-3.1.0-9.fc32.x86_64 is already installed.
Package python3-libselinux-3.0-3.fc32.x86_64 is already installed.
Package python3-lxml-4.4.1-4.fc32.x86_64 is already installed.
Package python3-nss-1.0.1-18.fc32.x86_64 is already installed.
Package python3-pyflakes-2.1.1-6.fc32.noarch is already installed.
Package python3-pylint-2.4.4-3.fc32.noarch is already installed.
Package python3-pytest-runner-4.0-9.fc32.noarch is already installed.
Package python3-requests-2.22.0-8.fc32.noarch is already installed.
Package python3-six-1.14.0-2.fc32.noarch is already installed.
Package python3-sphinx-1:2.2.2-2.fc32.noarch is already installed.
Package redhat-rpm-config-150-1.fc32.noarch is already installed.
Package resteasy-atom-provider-3.0.26-2.fc32.noarch is already installed.
Package resteasy-client-3.0.26-2.fc32.noarch is already installed.
Package resteasy-core-3.0.26-2.fc32.noarch is already installed.
Package resteasy-jackson2-provider-3.0.26-2.fc32.noarch is already installed.
Package resteasy-jaxb-provider-3.0.26-2.fc32.noarch is already installed.
Package slf4j-1.7.30-2.fc32.noarch is already installed.
Package slf4j-jdk14-1.7.30-2.fc32.noarch is already installed.
Package systemd-245.6-2.fc32.x86_64 is already installed.
Package systemd-245.6-2.fc32.x86_64 is already installed.
Package tomcat-1:9.0.36-1.fc32.noarch is already installed.
Package tomcatjss-7.5.0-0.1.fc32.noarch is already installed.
Package velocity-1.7-27.fc32.noarch is already installed.
Package xalan-j2-2.7.2-2.fc32.noarch is already installed.
Package xerces-j2-2.12.0-4.fc32.noarch is already installed.
Package zip-3.0-26.fc32.x86_64 is already installed.
Package zlib-1.2.11-21.fc32.x86_64 is already installed.
Package zlib-devel-1.2.11-21.fc32.x86_64 is already installed.

cipherboy commented 3 years ago

@olelar -- out of curiosity, if you downgrade to the last JSS v4.6.x version (v4.6.4 was shipped to Fedora IIRC), does this problem go away? If so, likely an issue with the new SSLEngine support, I'm not immediately sure how to fix it. I haven't gotten a good minimal reproducer. :/

Edited 3 years ago by cipherboy

olelar commented 3 years ago

@olelar -- out of curiosity, if you downgrade to the last JSS v4.6.x version (v4.6.4 was shipped to Fedora IIRC), does this problem go away? If so, likely an issue with the new SSLEngine support, I'm not immediately sure how to fix it. I haven't gotten a good minimal reproducer. :/

Hi, yes that does indeed solve it.

I ran:
sudo dnf downgrade jss --allowerasing

This removed tomcat-native (1.2.23-1.fc32) and downgraded
1) jss to 4.6.4-1.20200529212328.1bc08ed5.fc32
2) tomcatjss to 7.4.1-3.fc32

If I try to install tomcat-native again it wants to upgrade jss and tomcatjss again.

edewata commented 3 years ago

The problem should have been fixed in the latest jss-4.7 and tomcatjss-7.5. Feel free to reopen if the problem is still happening. Thanks!

Metadata Update from @edewata:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

3 years ago

dmoluguw commented 3 years ago

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/3306

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata

Assignee

None

Tags

None

Blocking

None

Depending on

None

Priority

None

Milestone

None

lowhangingfruit

None

reporter

None

rhbz

None

type

None

version

None

keywords

None

estimate

None

feature

None

origin

None

proposedpriority

None

fixedinversion

None

platforms

None

blockedby

None

blocking

None

reviewer

None

component

None

proposedmilestone

None

dogtagpki

Source Code

#3189 CA not approving CSR forwarded by ACME Responder Closed: fixed 3 years ago by edewata. Opened 3 years ago by olelar.

Description of problem

certbot log

ACME log

CA Log

How reproducible

How to reproduce

Versions

Expected result

Metadata

#3189 CA not approving CSR forwarded by ACME Responder

Closed: fixed 3 years ago by edewata. Opened 3 years ago by olelar.